Malicious
Malicious

08637a5f2fb2789dd0f9e3f186001bed

PE Executable
MD5: 08637a5f2fb2789dd0f9e3f186001bed
Size: 44.03 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 08637a5f2fb2789dd0f9e3f186001bed
Sha1 db71dc60a407bce99680fe4228bca26d90695dfb
Sha256 6b39054cd0facc18c46cf4ad3bdab92072a34933fab5cf67adefeb787e78b11c
Sha384 ad460b55e99ed948099d93841a9121fa8cd6845e9af622e889a7323665f8fc9aea345154fc117bab0b09a8dd40ce52f9
Sha512 94a78ba4fcf97ca77f18929a5f62e4a5d8209db50f000342499460a66e3e5ba63892a7522814a9aaa92cc77c402648b71c1ff89beecb25a3d38cf7ed31b93567
SSDeep 384:lHZyGssV6LkcyG29EfOmwVE3pOhC0pf/pqzkIij+ZsNO3PlpJKkkjh/TzF7pWn90:l5xtsYZGEEfiWpuLf/uuXQ/oYC+L
TLSH CC13E74CB694E175D5FF8BF0B4A1B2890B70A01BA906930F99F114D98FB3EC09611EE7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
08637a5f2fb2789dd0f9e3f186001bed
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] Dllhuhuhuhu
cnc_host [H] xuiandhuhuhuhuhuhuhuhuhuhuhu
icn #huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
RegistrySt Fhuhuhuhu
xDlol1 Javhuhuhuhu
Sleep Fhuhuhuhu
Sleep1 1huhuhuhu
reg_key [RG] Windhuhuhuhuhuhuhu
task [Task] Fhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
Hide Fhuhuhuhu
HP Thuhuhuhu
SPR fhuhuhuhu
victim_name [VN] Hahuhuhuhu
version [VR] Njrat huhuhuhuhuhuhuhuhuhuhu
splitter [Y] |Hhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void Stub.OK.j.A::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
436
Main Method
System.Void Stub.OK.j.A::main()
Main IL Instruction Count
20
Main IL 
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runx
ldnull <null>
ldftn System.Void Stub.OK.j.A::timx_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thx
ldsfld System.Threading.Thread Stub.OK.j.A::thx
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.1 <null>
stsfld System.Boolean Stub.OK.j.A::runy
ldnull <null>
ldftn System.Void Stub.OK.j.A::timy_run()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stsfld System.Threading.Thread Stub.OK.j.A::thy
ldsfld System.Threading.Thread Stub.OK.j.A::thy
callvirt System.Void System.Threading.Thread::Start()
call System.Void Stub.OK.j.OK::ko()
ret <null>
CnC CNCmalicious
xuiandhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
08637a5f2fb2789dd0f9e3f186001bed
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Resources.resources
Config. Field Value
packet_size [b] 5huhuhuhu
BD [BD] Fhuhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] Dllhuhuhuhu
cnc_host [H] xuiandhuhuhuhuhuhuhuhuhuhuhu
icn #huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
RegistrySt Fhuhuhuhu
xDlol1 Javhuhuhuhu
Sleep Fhuhuhuhu
Sleep1 1huhuhuhu
reg_key [RG] Windhuhuhuhuhuhuhu
task [Task] Fhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
Hide Fhuhuhuhu
HP Thuhuhuhu
SPR fhuhuhuhu
victim_name [VN] Hahuhuhuhu
version [VR] Njrat huhuhuhuhuhuhuhuhuhuhu
splitter [Y] |Hhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
xuiandhuhuhuhuhuhuhuhuhuhuhu
08637a5f2fb2789dd0f9e3f186001bed
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙